🎯 HackerOne MCP Server

Hey there! 👋 Welcome to the HackerOne MCP Server.

This tool seamlessly connects your favorite AI assistants (Claude Code, Claude Desktop, Cursor, Windsurf) directly to your HackerOne account.

Whether you want to search your past reports, manage draft report intents, check program scope rules & exclusions, analyze bounty payouts, draft vulnerability write-ups, or reply to triagers — your AI can now help you do it all right from your chat window! 🚀

⚡ Quick Start (60 Seconds)

1. Grab your HackerOne API Token

Head over to HackerOne > Settings > API Token and generate your token.

2. Build the project

git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run build

3. Add to your AI Client

🌐 Via Smithery.ai (Easiest)

npx -y @smithery/cli mcp add hackerone-mcp-server

💻 Claude Code (Local)

claude mcp add hackerone \
  -e H1_USERNAME="your-h1-username" \
  -e H1_API_TOKEN="your-h1-api-token" \
  -s user \
  -- node /path/to/hackerone-mcp-server/dist/index.js

🖥️ Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "hackerone": {
      "command": "node",
      "args": ["/path/to/hackerone-mcp-server/dist/index.js"],
      "env": {
        "H1_USERNAME": "your-h1-username",
        "H1_API_TOKEN": "your-h1-api-token"
      }
    }
  }
}

🖱️ Cursor / Windsurf

In your editor's MCP Settings, add a new server:

• Type: stdio

• Command: node /path/to/hackerone-mcp-server/dist/index.js

• Env: Set H1_USERNAME and H1_API_TOKEN

Related MCP server: h1-brain

💡 Cool Things You Can Ask Your AI

Here are a few fun prompts to try out:

• 🔍 Recon & Scope: "Show me the in-scope assets and scope exclusions for uber. What are their response times and accepted vulnerability types?"

• 📝 Report Intents (Drafts): "Create a new report intent draft for program gitlab titled 'XSS in search endpoint'. Let's refine the write-up before submitting."

• 💬 Triage Assistance: "The triager on report #123456 requested an updated PoC. Help me write a friendly technical response."

• 💰 Check Stats & Payouts: "How much unpaid balance do I have on HackerOne right now, and show my payout history via PayPal?"

• 📊 Analyze Patterns: "Analyze my report history — what severity gets resolved the fastest for me?"

• 🔎 Hacktivity Research: "Search disclosed reports on github for IDOR vulnerabilities to see what they usually pay."

🧰 What's Included?

🛠️ Tools (Actions your AI can take)

📌 Resources (Instant context for your AI)

Your AI can instantly look up these hackerone:// URIs:

• 👤 hackerone://profile — Your live reputation, signal, impact, and rank.

• 💵 hackerone://balance — Your unpaid balance.

• 📈 hackerone://earnings/recent — Your latest bounty payouts.

• 📋 hackerone://reports/recent — Your 10 latest submitted reports.

• 🔥 hackerone://hacktivity/trending — Top upvoted public reports on Hacktivity.

💬 Prompts (Guided workflows)

• find-best-bounty-program: Automated strategy prompt to find & rank the highest-paying, fast-response target programs.

• draft-vulnerability-report: Step-by-step guide to draft a top-tier report.

• triage-response-assistant: Craft polite, effective replies to triagers.

• analyze-program-scope: Break down a program's assets to find high-yield targets.

• summarize-hunting-profile: Create a neat summary dashboard of your research stats.

⚙️ Configuration Options

🔒 Security & Privacy

• 100% Local: Runs completely on your local machine using stdio transport.

• Your Credentials Stay Yours: Your API keys are kept strictly in your local environment variables and never sent anywhere except directly to HackerOne's official API.

📜 License

MIT License — Feel free to use, modify, and share! Happy hunting! 🎯